mirror of
https://github.com/storytold/terraform-aws-observability-accelerator.git
synced 2026-10-09 00:09:43 +00:00
Add local example for empty EKS Cluster
This commit is contained in:
Rodrigue Koffi
@@ -0,0 +1,99 @@
|
|||||||
|
# EKS Cluster Deployment with new VPC
|
||||||
|
|
||||||
|
Note: This example is a subset from [this EKS Blueprint example](https://github.com/aws-ia/terraform-aws-eks-blueprints/tree/main/examples/eks-cluster-with-new-vpc)
|
||||||
|
|
||||||
|
This example deploys the following Basic EKS Cluster with VPC
|
||||||
|
|
||||||
|
- Creates a new sample VPC, 3 Private Subnets and 3 Public Subnets
|
||||||
|
- Creates Internet gateway for Public Subnets and NAT Gateway for Private Subnets
|
||||||
|
- Creates EKS Cluster Control plane with one managed node group
|
||||||
|
|
||||||
|
## How to Deploy
|
||||||
|
|
||||||
|
### Prerequisites
|
||||||
|
|
||||||
|
Ensure that you have installed the following tools in your Mac or Windows Laptop before start working with this module and run Terraform Plan and Apply
|
||||||
|
|
||||||
|
1. [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html)
|
||||||
|
2. [Kubectl](https://Kubernetes.io/docs/tasks/tools/)
|
||||||
|
3. [Terraform](https://learn.hashicorp.com/tutorials/terraform/install-cli)
|
||||||
|
|
||||||
|
### Minimum IAM Policy
|
||||||
|
|
||||||
|
> **Note**: The policy resource is set as `*` to allow all resources, this is not a recommended practice.
|
||||||
|
|
||||||
|
You can find the policy [here](min-iam-policy.json)
|
||||||
|
|
||||||
|
|
||||||
|
### Deployment Steps
|
||||||
|
|
||||||
|
#### Step 1: Clone the repo using the command below
|
||||||
|
|
||||||
|
```sh
|
||||||
|
git clone https://github.com/aws-observability/terraform-aws-observability-accelerator.git
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Step 2: Run Terraform INIT
|
||||||
|
|
||||||
|
Initialize a working directory with configuration files
|
||||||
|
|
||||||
|
```sh
|
||||||
|
cd examples/eks-cluster-with-vpc/
|
||||||
|
terraform init
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Step 3: Run Terraform PLAN
|
||||||
|
|
||||||
|
Verify the resources created by this execution
|
||||||
|
|
||||||
|
```sh
|
||||||
|
export TF_VAR_aws_region=<ENTER YOUR REGION> # Select your own region
|
||||||
|
terraform plan
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Step 4: Finally, Terraform APPLY
|
||||||
|
|
||||||
|
**Deploy the pattern**
|
||||||
|
|
||||||
|
```sh
|
||||||
|
terraform apply
|
||||||
|
```
|
||||||
|
|
||||||
|
Enter `yes` to apply.
|
||||||
|
|
||||||
|
### Configure `kubectl` and test cluster
|
||||||
|
|
||||||
|
EKS Cluster details can be extracted from terraform output or from AWS Console to get the name of cluster.
|
||||||
|
This following command used to update the `kubeconfig` in your local machine where you run kubectl commands to interact with your EKS Cluster.
|
||||||
|
|
||||||
|
#### Step 5: Run `update-kubeconfig` command
|
||||||
|
|
||||||
|
`~/.kube/config` file gets updated with cluster details and certificate from the below command
|
||||||
|
|
||||||
|
aws eks --region <enter-your-region> update-kubeconfig --name <cluster-name>
|
||||||
|
|
||||||
|
#### Step 6: List all the worker nodes by running the command below
|
||||||
|
|
||||||
|
kubectl get nodes
|
||||||
|
|
||||||
|
#### Step 7: List all the pods running in `kube-system` namespace
|
||||||
|
|
||||||
|
kubectl get pods -n kube-system
|
||||||
|
|
||||||
|
## Cleanup
|
||||||
|
|
||||||
|
To clean up your environment, destroy the Terraform modules in reverse order.
|
||||||
|
|
||||||
|
Destroy the Kubernetes Add-ons, EKS cluster with Node groups and VPC
|
||||||
|
|
||||||
|
```sh
|
||||||
|
terraform destroy -target="module.eks_blueprints_kubernetes_addons" -auto-approve
|
||||||
|
terraform destroy -target="module.eks_blueprints" -auto-approve
|
||||||
|
terraform destroy -target="module.vpc" -auto-approve
|
||||||
|
```
|
||||||
|
|
||||||
|
Finally, destroy any additional resources that are not in the above modules
|
||||||
|
|
||||||
|
```sh
|
||||||
|
terraform destroy -auto-approve
|
||||||
|
```
|
||||||
@@ -0,0 +1,119 @@
|
|||||||
|
provider "aws" {
|
||||||
|
region = local.region
|
||||||
|
}
|
||||||
|
|
||||||
|
provider "kubernetes" {
|
||||||
|
host = module.eks_blueprints.eks_cluster_endpoint
|
||||||
|
cluster_ca_certificate = base64decode(module.eks_blueprints.eks_cluster_certificate_authority_data)
|
||||||
|
token = data.aws_eks_cluster_auth.this.token
|
||||||
|
}
|
||||||
|
|
||||||
|
provider "helm" {
|
||||||
|
kubernetes {
|
||||||
|
host = module.eks_blueprints.eks_cluster_endpoint
|
||||||
|
cluster_ca_certificate = base64decode(module.eks_blueprints.eks_cluster_certificate_authority_data)
|
||||||
|
token = data.aws_eks_cluster_auth.this.token
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
data "aws_eks_cluster_auth" "this" {
|
||||||
|
name = module.eks_blueprints.eks_cluster_id
|
||||||
|
}
|
||||||
|
|
||||||
|
data "aws_availability_zones" "available" {}
|
||||||
|
|
||||||
|
locals {
|
||||||
|
name = basename(path.cwd)
|
||||||
|
cluster_name = coalesce(var.cluster_name, local.name)
|
||||||
|
region = var.aws_region
|
||||||
|
|
||||||
|
vpc_cidr = "10.0.0.0/16"
|
||||||
|
azs = slice(data.aws_availability_zones.available.names, 0, 3)
|
||||||
|
|
||||||
|
tags = {
|
||||||
|
Blueprint = local.name
|
||||||
|
GithubRepo = "github.com/aws-observability/terraform-aws-observability-accelerator"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#---------------------------------------------------------------
|
||||||
|
# EKS Blueprints
|
||||||
|
#---------------------------------------------------------------
|
||||||
|
|
||||||
|
module "eks_blueprints" {
|
||||||
|
source = "github.com/aws-ia/terraform-aws-eks-blueprints"
|
||||||
|
|
||||||
|
cluster_name = local.cluster_name
|
||||||
|
cluster_version = "1.23"
|
||||||
|
|
||||||
|
vpc_id = module.vpc.vpc_id
|
||||||
|
private_subnet_ids = module.vpc.private_subnets
|
||||||
|
|
||||||
|
managed_node_groups = {
|
||||||
|
mg_5 = {
|
||||||
|
node_group_name = "managed-ondemand"
|
||||||
|
instance_types = ["m5.large"]
|
||||||
|
min_size = 2
|
||||||
|
subnet_ids = module.vpc.private_subnets
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
tags = local.tags
|
||||||
|
}
|
||||||
|
|
||||||
|
module "eks_blueprints_kubernetes_addons" {
|
||||||
|
source = "github.com/aws-ia/terraform-aws-eks-blueprints/modules/kubernetes-addons"
|
||||||
|
|
||||||
|
eks_cluster_id = module.eks_blueprints.eks_cluster_id
|
||||||
|
eks_cluster_endpoint = module.eks_blueprints.eks_cluster_endpoint
|
||||||
|
eks_oidc_provider = module.eks_blueprints.oidc_provider
|
||||||
|
eks_cluster_version = module.eks_blueprints.eks_cluster_version
|
||||||
|
|
||||||
|
# EKS Managed Add-ons
|
||||||
|
enable_amazon_eks_vpc_cni = true
|
||||||
|
enable_amazon_eks_coredns = true
|
||||||
|
enable_amazon_eks_kube_proxy = true
|
||||||
|
enable_amazon_eks_aws_ebs_csi_driver = true
|
||||||
|
|
||||||
|
tags = local.tags
|
||||||
|
}
|
||||||
|
|
||||||
|
#---------------------------------------------------------------
|
||||||
|
# Supporting Resources
|
||||||
|
#---------------------------------------------------------------
|
||||||
|
|
||||||
|
module "vpc" {
|
||||||
|
source = "terraform-aws-modules/vpc/aws"
|
||||||
|
version = "~> 3.0"
|
||||||
|
|
||||||
|
name = local.name
|
||||||
|
cidr = local.vpc_cidr
|
||||||
|
|
||||||
|
azs = local.azs
|
||||||
|
public_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)]
|
||||||
|
private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 10)]
|
||||||
|
|
||||||
|
enable_nat_gateway = true
|
||||||
|
single_nat_gateway = true
|
||||||
|
enable_dns_hostnames = true
|
||||||
|
|
||||||
|
# Manage so we can name
|
||||||
|
manage_default_network_acl = true
|
||||||
|
default_network_acl_tags = { Name = "${local.name}-default" }
|
||||||
|
manage_default_route_table = true
|
||||||
|
default_route_table_tags = { Name = "${local.name}-default" }
|
||||||
|
manage_default_security_group = true
|
||||||
|
default_security_group_tags = { Name = "${local.name}-default" }
|
||||||
|
|
||||||
|
public_subnet_tags = {
|
||||||
|
"kubernetes.io/cluster/${local.cluster_name}" = "shared"
|
||||||
|
"kubernetes.io/role/elb" = 1
|
||||||
|
}
|
||||||
|
|
||||||
|
private_subnet_tags = {
|
||||||
|
"kubernetes.io/cluster/${local.cluster_name}" = "shared"
|
||||||
|
"kubernetes.io/role/internal-elb" = 1
|
||||||
|
}
|
||||||
|
|
||||||
|
tags = local.tags
|
||||||
|
}
|
||||||
@@ -0,0 +1,105 @@
|
|||||||
|
{
|
||||||
|
"Version": "2012-10-17",
|
||||||
|
"Statement": [
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"ec2:AllocateAddress",
|
||||||
|
"ec2:AssociateRouteTable",
|
||||||
|
"ec2:AttachInternetGateway",
|
||||||
|
"ec2:AuthorizeSecurityGroupEgress",
|
||||||
|
"ec2:AuthorizeSecurityGroupIngress",
|
||||||
|
"ec2:CreateInternetGateway",
|
||||||
|
"ec2:CreateNatGateway",
|
||||||
|
"ec2:CreateNetworkAclEntry",
|
||||||
|
"ec2:CreateRoute",
|
||||||
|
"ec2:CreateRouteTable",
|
||||||
|
"ec2:CreateSecurityGroup",
|
||||||
|
"ec2:CreateSubnet",
|
||||||
|
"ec2:CreateTags",
|
||||||
|
"ec2:CreateVpc",
|
||||||
|
"ec2:DeleteInternetGateway",
|
||||||
|
"ec2:DeleteNatGateway",
|
||||||
|
"ec2:DeleteNetworkAclEntry",
|
||||||
|
"ec2:DeleteRoute",
|
||||||
|
"ec2:DeleteRouteTable",
|
||||||
|
"ec2:DeleteSecurityGroup",
|
||||||
|
"ec2:DeleteSubnet",
|
||||||
|
"ec2:DeleteTags",
|
||||||
|
"ec2:DeleteVpc",
|
||||||
|
"ec2:DescribeAccountAttributes",
|
||||||
|
"ec2:DescribeAddresses",
|
||||||
|
"ec2:DescribeAvailabilityZones",
|
||||||
|
"ec2:DescribeInternetGateways",
|
||||||
|
"ec2:DescribeNatGateways",
|
||||||
|
"ec2:DescribeNetworkAcls",
|
||||||
|
"ec2:DescribeNetworkInterfaces",
|
||||||
|
"ec2:DescribeRouteTables",
|
||||||
|
"ec2:DescribeSecurityGroups",
|
||||||
|
"ec2:DescribeSubnets",
|
||||||
|
"ec2:DescribeTags",
|
||||||
|
"ec2:DescribeVpcAttribute",
|
||||||
|
"ec2:DescribeVpcClassicLink",
|
||||||
|
"ec2:DescribeVpcClassicLinkDnsSupport",
|
||||||
|
"ec2:DescribeVpcs",
|
||||||
|
"ec2:DetachInternetGateway",
|
||||||
|
"ec2:DisassociateRouteTable",
|
||||||
|
"ec2:ModifySubnetAttribute",
|
||||||
|
"ec2:ModifyVpcAttribute",
|
||||||
|
"ec2:ReleaseAddress",
|
||||||
|
"ec2:RevokeSecurityGroupEgress",
|
||||||
|
"ec2:RevokeSecurityGroupIngress",
|
||||||
|
"eks:CreateAddon",
|
||||||
|
"eks:CreateCluster",
|
||||||
|
"eks:CreateNodegroup",
|
||||||
|
"eks:DeleteAddon",
|
||||||
|
"eks:DeleteCluster",
|
||||||
|
"eks:DeleteNodegroup",
|
||||||
|
"eks:DescribeAddon",
|
||||||
|
"eks:DescribeAddonVersions",
|
||||||
|
"eks:DescribeCluster",
|
||||||
|
"eks:DescribeNodegroup",
|
||||||
|
"iam:AddRoleToInstanceProfile",
|
||||||
|
"iam:AttachRolePolicy",
|
||||||
|
"iam:CreateInstanceProfile",
|
||||||
|
"iam:CreateOpenIDConnectProvider",
|
||||||
|
"iam:CreatePolicy",
|
||||||
|
"iam:CreateRole",
|
||||||
|
"iam:CreateServiceLinkedRole",
|
||||||
|
"iam:DeleteInstanceProfile",
|
||||||
|
"iam:DeleteOpenIDConnectProvider",
|
||||||
|
"iam:DeletePolicy",
|
||||||
|
"iam:DeleteRole",
|
||||||
|
"iam:DetachRolePolicy",
|
||||||
|
"iam:GetInstanceProfile",
|
||||||
|
"iam:GetOpenIDConnectProvider",
|
||||||
|
"iam:GetPolicy",
|
||||||
|
"iam:GetPolicyVersion",
|
||||||
|
"iam:GetRole",
|
||||||
|
"iam:ListAttachedRolePolicies",
|
||||||
|
"iam:ListInstanceProfilesForRole",
|
||||||
|
"iam:ListPolicyVersions",
|
||||||
|
"iam:ListRolePolicies",
|
||||||
|
"iam:PassRole",
|
||||||
|
"iam:RemoveRoleFromInstanceProfile",
|
||||||
|
"iam:TagInstanceProfile",
|
||||||
|
"kms:CreateAlias",
|
||||||
|
"kms:CreateKey",
|
||||||
|
"kms:DeleteAlias",
|
||||||
|
"kms:DescribeKey",
|
||||||
|
"kms:EnableKeyRotation",
|
||||||
|
"kms:GetKeyPolicy",
|
||||||
|
"kms:GetKeyRotationStatus",
|
||||||
|
"kms:ListAliases",
|
||||||
|
"kms:ListResourceTags",
|
||||||
|
"kms:PutKeyPolicy",
|
||||||
|
"kms:ScheduleKeyDeletion",
|
||||||
|
"kms:TagResource",
|
||||||
|
"s3:GetObject",
|
||||||
|
"s3:ListBucket",
|
||||||
|
"s3:PutObject"
|
||||||
|
],
|
||||||
|
"Resource": "*"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
@@ -0,0 +1,49 @@
|
|||||||
|
output "vpc_private_subnet_cidr" {
|
||||||
|
description = "VPC private subnet CIDR"
|
||||||
|
value = module.vpc.private_subnets_cidr_blocks
|
||||||
|
}
|
||||||
|
|
||||||
|
output "vpc_public_subnet_cidr" {
|
||||||
|
description = "VPC public subnet CIDR"
|
||||||
|
value = module.vpc.public_subnets_cidr_blocks
|
||||||
|
}
|
||||||
|
|
||||||
|
output "vpc_cidr" {
|
||||||
|
description = "VPC CIDR"
|
||||||
|
value = module.vpc.vpc_cidr_block
|
||||||
|
}
|
||||||
|
|
||||||
|
output "eks_cluster_id" {
|
||||||
|
description = "EKS cluster ID"
|
||||||
|
value = module.eks_blueprints.eks_cluster_id
|
||||||
|
}
|
||||||
|
|
||||||
|
output "eks_managed_nodegroups" {
|
||||||
|
description = "EKS managed node groups"
|
||||||
|
value = module.eks_blueprints.managed_node_groups
|
||||||
|
}
|
||||||
|
|
||||||
|
output "eks_managed_nodegroup_ids" {
|
||||||
|
description = "EKS managed node group ids"
|
||||||
|
value = module.eks_blueprints.managed_node_groups_id
|
||||||
|
}
|
||||||
|
|
||||||
|
output "eks_managed_nodegroup_arns" {
|
||||||
|
description = "EKS managed node group arns"
|
||||||
|
value = module.eks_blueprints.managed_node_group_arn
|
||||||
|
}
|
||||||
|
|
||||||
|
output "eks_managed_nodegroup_role_name" {
|
||||||
|
description = "EKS managed node group role name"
|
||||||
|
value = module.eks_blueprints.managed_node_group_iam_role_names
|
||||||
|
}
|
||||||
|
|
||||||
|
output "eks_managed_nodegroup_status" {
|
||||||
|
description = "EKS managed node group status"
|
||||||
|
value = module.eks_blueprints.managed_node_groups_status
|
||||||
|
}
|
||||||
|
|
||||||
|
output "configure_kubectl" {
|
||||||
|
description = "Configure kubectl: make sure you're logged in with the correct AWS profile and run the following command to update your kubeconfig"
|
||||||
|
value = module.eks_blueprints.configure_kubectl
|
||||||
|
}
|
||||||
@@ -0,0 +1,9 @@
|
|||||||
|
variable "cluster_name" {
|
||||||
|
description = "Name of cluster - used by Terratest for e2e test automation"
|
||||||
|
type = string
|
||||||
|
default = ""
|
||||||
|
}
|
||||||
|
variable "aws_region" {
|
||||||
|
description = "AWS Region"
|
||||||
|
type = string
|
||||||
|
}
|
||||||
Reference in New Issue
Block a user